diff --git a/inventories/client_template/group_vars/pfsense_nodes.yml b/inventories/client_template/group_vars/pfsense_nodes.yml
index b59d9d3..c0c2f1b 100644
--- a/inventories/client_template/group_vars/pfsense_nodes.yml
+++ b/inventories/client_template/group_vars/pfsense_nodes.yml
@@ -1,6 +1,6 @@
 ---
 # inventory/group_vars/pfsense_nodes.yml
-# Applied to all hosts in the [pfsense] group.
+# Applied to all hosts in the [pfsense_nodes] group.
 
 # pfSense runs FreeBSD — Python may not be installed.
 # Using 'raw' module throughout the role avoids this entirely,
@@ -24,7 +24,7 @@ ansible_shell_executable: /bin/sh
 # ansible_ssh_private_key_file: ~/.ssh/pfsense_rsa
 
 # Default upgrade settings (can be overridden per host in host_vars/)
-perform_upgrade: false
-allow_major_upgrade: false
-auto_reboot: true
-pkg_repo_update: true
+perform_upgrade: "{{ perform_upgrade | default(false) }}"
+allow_major_upgrade: "{{ allow_major_upgrade | default(false) }}"
+auto_reboot: "{{ auto_reboot | default(true) }}"
+pkg_repo_update: "{{ pkg_repo_update | default(true) }}